Symmetric key cryptography is currently used in a secure payment infrastructure to generate a one-time passcode (OTP) that can also serve as a digital signature, using a smart card and dedicated card reader hardware in a two factor authentication process. This method inconveniences the cardholder by requiring the presence of the card reader and smart card to securely host the software and keys used to generate the OTP. In a typical scenario the purchaser inserts her smart card into an unconnected reader with a pinpad, enters a PIN, and reads an OTP off a display. The purchaser types the OTP into a browser web page, or dictates it into a telephone, or otherwise conveys it to an authenticating entity. The smart card and reader are in the possession of the purchaser and are typically carried on the purchaser's person.
The “EuroPay, MasterCard, and Visa” (EMV) consortium, which develops and maintains global standards for credit and debit payment cards based on chip card technology has defined a standardized smart card, referred to as “Chipcard” to work within the EMV 3-D Secure payment infrastructure, with standardized smart card readers, cryptograms, etc. EMV Chipcards use symmetric key cryptography for signing and authentication. In an EMV system, the provisioning server and the authenticating server each have a copy of a Triple Data Encryption Standard (Triple-DES) “Master Derivation Key” or “MDK” in hardware. For each user, where the user is identified by a Primary Account Number (PAN), the provisioning server applies the MDK to the PAN and the PAN Sequence Number and generates two symmetric DES keys, which are referred to as Unique DEA Key A (UDKA) and a Unique DEA Key B (UDKB), which go into the Chipcard for that user. Note that the authenticating server can regenerate UDKA and UDKB at any time, using the user PAN information and the MDK.
Cryptographic or secure signing is possible with symmetric keys, such as the DES keys UDKA and UDKB, when the end user (through the UDKA and UDKB in the Chipcard) and the provider system (through the MDK in the provisioning and authenticating server hardware) have access to the user's symmetric key(s). Therefore, the security of the EMV system is based on the security of the authenticating and provisioning servers, the security of the Chipcard, and the secure use of the Chipcard with the card reader.
During a purchase sequence, if the user submits the right PIN to the user's Chipcard, the keys UDKA and UDKB will be available for use inside the card. If the user submits several wrong PINs in a row, the card locks. The Chipcard typically collects transaction information and a random number from the server, and generates a cryptogram, called an Authorization Request Cryptogram (ARQC). The ARQC is digitally “signed” by the two DES keys (UDKA and UDKB) in the Chipcard. The data and the ARQC are sent through the card reader, which is attached to the network, to the authenticating server. The authenticating server recreates the cryptogram, and if it matches the ARQC from the client, the purchase is approved. In some systems, purchase approval may also be subject to some other checks, which may include checks of data elements inputted to the signing algorithm. The application transaction counter (ATC) is incremented on the client, e.g., the Chipcard, and the server, and the server stores the counter in a database.
In a variant on this, a passcode generating system is available in which the smart payment card is used with a disconnected reader that does not communicate with a network during an online or telephone purchase. The stand-alone reader is typically pocket-sized and has a pin pad and an LCD display. The purchaser/user/cardholder inserts the smart payment card into the reader, and inputs a correct PIN via a pinpad on the reader. An ARQC is generated in the card, but the full ARQC, which is binary, is not displayed to the user. Instead, an OTP is constructed using binary bits from the ARQC and other data elements on the card. The OTP is a decimal number of a manageable size for a human (typically 6 to 9 digits). The user views the OTP and manually types it into a web form, telephone pinpad, or speaks it during a CNP purchase or payment transaction. The authenticating server regenerates the cardholder's OTP and compares the OTP provided by the user with the regenerated OTP. Upon matching, the server authorizes the purchase transaction. In both the case of the connected card reader and disconnected reader, an ATC is incremented on the client, e.g., the card reader, and the server. The ATC is incremented each time to ensure a fresh passcode and guards against certain types of attacks, for example, a replay attack. However, the client ATC and the server ATC can get out of synchrony, inconveniencing the client by locking the card and/or card reader until the client ATC and server ATC is resynchronized, where resynchronization may require reissuance of the Chipcard and/or the card reader to the cardholder.
Visa Dynamic Passcode Authentication (DPA) and MasterCard Chip Authentication Protocol (CAP) are two initiatives (among others) derived from the EMV Chipcard specification to implement the variant just described. The EMV Chipcard user is inconvenienced when completing a transaction by the need to use a card reader either connected to the provider system or an online computer, or to use a disconnected handheld unit which must be carried by the user. In the latter case, a separate handheld unit may be required for each Chipcard type or provider. Other potential disadvantages include client-server ATC nonsynchrony and locked Chipcards resulting from incorrectly inputted PIN attempts.